ultra11y 5.33.1 → 5.34.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.33.1",
+      "version": "5.34.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.33.1",
+  "version": "5.34.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.33.1",
+  "version": "5.34.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.33.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.34.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.33.1",
+  "version": "5.34.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.33.1";
+var VERSION = "5.34.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2293,7 +2293,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-24 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-25 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -60588,6 +60588,7 @@ function applyRawVerdicts(items, verdicts) {
 var ALLOWED_TOOLS = "Read,Grep,Glob";
 var MAX_ATTEMPTS2 = 4;
 var DEFAULT_CLI_MODEL = "claude-haiku-4-5-20251001";
+var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var DEFAULT_TIMEOUT_MS2 = 10 * 6e4;
 function realSpawn(argv, input, timeoutMs) {
   return new Promise((resolve17, reject) => {
@@ -60664,6 +60665,7 @@ function cliArgv(opts, items) {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return argv;
 }
 function verdictsFromText(text) {
@@ -60726,6 +60728,7 @@ async function refuteBatchCli(items, prompt, opts, lang = "en") {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return runCli2(argv, prompt, opts, (env) => {
     const structured = env.structured_output?.verdicts;
     const raw = Array.isArray(structured) ? structured : verdictsArrayFromText(env.result ?? "");
@@ -68889,7 +68892,7 @@ Usage:
   ultra11y orchestrate --run <dir> [--phase adjudicate|verify-report] [--eco] [--list] [--lang auto|en|fr]
   ultra11y fix      <globs\u2026 | -> [--write] [--iterate] [--changed | --since <ref> | --staged] [--safe] [--include <glob>] [--exclude <glob>] [--ext <list>] [--only <ids>] [--jsx] [--json] [--lang auto|en|fr]
   ultra11y init     [--hook] [--ci] [--baseline] [--fail-on blocking|major|minor]
-  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
+  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--effort <level>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
   ultra11y pack     check <pack.json> [--guidance <g.json>] [--json]  |  pack scaffold
   ultra11y scan     <url|file\u2026> [--runtime auto|local|docker] [--cwd <dir>] [--storage-state <file>] [--no-interact] [--interact-clicks] [--no-snapshot] [--merge <audit.json>] [--out <dir>] [--json]
   ultra11y scan     --sample [--runtime \u2026] [--cwd <dir>] [--storage-state <file>] [--merge <audit.json>] [--json]   (scan the .ultra11yrc.json page sample)
@@ -69122,6 +69125,8 @@ Options:
   --provider <id>    tickets: auto|github|gitlab|jira. 'auto' reads ULTRA11Y_TICKET_PROVIDER,
                      then .ultra11yrc.json, then the git remote (Jira is never auto-detected)
   --grain <mode>     tickets: what one ticket is \u2014 criterion (default) | page | page-criterion | single | file
+  --effort <level>   judge (--runner cli): reasoning effort per invocation \u2014 low | medium |
+                     high | xhigh | max. Unset leaves the CLI's own default
   --transport <t>    tickets: auto|cli|rest (mcp: stdio|http). 'auto' prefers the CLI (gh/glab),
                      falling back to REST when only a token is available. Jira is REST-only
   --max-tickets <n>  tickets: refuse to file more than n tickets in one run (default 200)
@@ -69325,6 +69330,7 @@ var VALUE_FLAGS2 = /* @__PURE__ */ new Set([
   "runner",
   "grain",
   "max-budget-usd",
+  "effort",
   "timeout",
   "concurrency",
   "out",
@@ -71460,6 +71466,15 @@ async function cmdJudge(p) {
     console.error(`ultra11y judge: --grain '${grain}' is not a grain \u2014 expected 'batch' or 'criterion'.`);
     return 2;
   }
+  const effort = typeof p.flags.effort === "string" ? p.flags.effort : void 0;
+  if (effort !== void 0 && !EFFORT_LEVELS.includes(effort)) {
+    console.error(`ultra11y judge: --effort '${effort}' is not a level \u2014 expected ${EFFORT_LEVELS.map((l) => `'${l}'`).join(", ")}.`);
+    return 2;
+  }
+  if (effort !== void 0 && runner !== "cli") {
+    console.error("ultra11y judge: --effort applies to `--runner cli` only \u2014 the Messages API has no session to set an effort on.");
+    return 2;
+  }
   const key2 = typeof p.flags["api-key"] === "string" && p.flags["api-key"] ? p.flags["api-key"] : apiKeyFromEnv();
   if (!key2 && runner === "api") {
     console.error(
@@ -71533,6 +71548,7 @@ async function cmdJudge(p) {
     // requests do. `--concurrency` overrides it for a runner with room.
     concurrency: runner === "cli" ? cliConcurrency : void 0,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
+    effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,
     onCost: (usd) => {
       spent += usd;

package/scripts/vendor/wcag-2.2-fr.json

@@ -1,6 +1,6 @@
 {
   "source": "https://www.w3.org/Translations/WCAG22-fr/",
-  "fetchedAt": "2026-08-24",
+  "fetchedAt": "2026-08-25",
   "principles": {
     "1": "Perceptible",
     "2": "Utilisable",

package/scripts/vendor/wcag-2.2-sc-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-24 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-25 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "principles": [
     {
       "number": 1,

package/scripts/vendor/wcag-2.2-techniques.json

@@ -2,7 +2,7 @@
   "source": "https://github.com/w3c/wcag",
   "understanding": "https://www.w3.org/WAI/WCAG22/Understanding/",
   "license": "W3C Document License (code samples: W3C Software License)",
-  "fetchedAt": "2026-08-24",
+  "fetchedAt": "2026-08-25",
   "criteria": {
     "1.1.1": {
       "slug": "non-text-content",

package/scripts/vendor/wcag-2.2-text.json

@@ -1,7 +1,7 @@
 {
   "source": "https://github.com/w3c/wcag",
   "license": "W3C Document License",
-  "fetchedAt": "2026-08-24",
+  "fetchedAt": "2026-08-25",
   "criteria": {
     "1.1.1": "All non-text content that is presented to the user has a text alternative that serves the equivalent purpose, except for the situations listed below.\nControls, Input:\nIf non-text content is a control or accepts user input, then it has a name that describes its purpose. (Refer to Success Criterion 4.1.2 Name, Role, Value for additional requirements for controls and content that accepts user input.)\nTime-Based Media:\nIf non-text content is time-based media, then text alternatives at least provide descriptive identification of the non-text content. (Refer to Guideline 1.2 for additional requirements for media.)\nTest:\nIf non-text content is a test or exercise that would be invalid if presented in text, then text alternatives at least provide descriptive identification of the non-text content.\nSensory:\nIf non-text content is primarily intended to create a specific sensory experience, then text alternatives at least provide descriptive identification of the non-text content.\nCAPTCHA:\nIf the purpose of non-text content is to confirm that content is being accessed by a person rather than a computer, then text alternatives that identify and describe the purpose of the non-text content are provided, and alternative forms of CAPTCHA using output modes for different types of sensory perception are provided to accommodate different disabilities.\nDecoration, Formatting, Invisible:\nIf non-text content is pure decoration, is used only for visual formatting, or is not presented to users, then it is implemented in a way that it can be ignored by assistive technology.",
     "1.2.1": "For prerecorded audio-only and prerecorded video-only media, the following are true, except when the audio or video is a media alternative for text and is clearly labeled as such:\nPrerecorded Audio-only:\nAn alternative for time-based media is provided that presents equivalent information for prerecorded audio-only content.\nPrerecorded Video-only:\nEither an alternative for time-based media or an audio track is provided that presents equivalent information for prerecorded video-only content.",

package/skills/review-a11y/SKILL.md

@@ -5,7 +5,7 @@ when_to_use: "Invoke WITHOUT being asked whenever changed front-end code should
 allowed-tools: Bash(node ${CLAUDE_SKILL_DIR}/scripts/ultra11y.mjs *), Read, Grep, Glob
 license: MIT
 metadata:
-  version: 5.33.1
+  version: 5.34.0
 ---
 
 # review-a11y — accessibility review of changed code

package/skills/review-a11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.33.1";
+var VERSION = "5.34.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2293,7 +2293,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-24 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-25 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -60588,6 +60588,7 @@ function applyRawVerdicts(items, verdicts) {
 var ALLOWED_TOOLS = "Read,Grep,Glob";
 var MAX_ATTEMPTS2 = 4;
 var DEFAULT_CLI_MODEL = "claude-haiku-4-5-20251001";
+var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var DEFAULT_TIMEOUT_MS2 = 10 * 6e4;
 function realSpawn(argv, input, timeoutMs) {
   return new Promise((resolve17, reject) => {
@@ -60664,6 +60665,7 @@ function cliArgv(opts, items) {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return argv;
 }
 function verdictsFromText(text) {
@@ -60726,6 +60728,7 @@ async function refuteBatchCli(items, prompt, opts, lang = "en") {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return runCli2(argv, prompt, opts, (env) => {
     const structured = env.structured_output?.verdicts;
     const raw = Array.isArray(structured) ? structured : verdictsArrayFromText(env.result ?? "");
@@ -68889,7 +68892,7 @@ Usage:
   ultra11y orchestrate --run <dir> [--phase adjudicate|verify-report] [--eco] [--list] [--lang auto|en|fr]
   ultra11y fix      <globs\u2026 | -> [--write] [--iterate] [--changed | --since <ref> | --staged] [--safe] [--include <glob>] [--exclude <glob>] [--ext <list>] [--only <ids>] [--jsx] [--json] [--lang auto|en|fr]
   ultra11y init     [--hook] [--ci] [--baseline] [--fail-on blocking|major|minor]
-  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
+  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--effort <level>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
   ultra11y pack     check <pack.json> [--guidance <g.json>] [--json]  |  pack scaffold
   ultra11y scan     <url|file\u2026> [--runtime auto|local|docker] [--cwd <dir>] [--storage-state <file>] [--no-interact] [--interact-clicks] [--no-snapshot] [--merge <audit.json>] [--out <dir>] [--json]
   ultra11y scan     --sample [--runtime \u2026] [--cwd <dir>] [--storage-state <file>] [--merge <audit.json>] [--json]   (scan the .ultra11yrc.json page sample)
@@ -69122,6 +69125,8 @@ Options:
   --provider <id>    tickets: auto|github|gitlab|jira. 'auto' reads ULTRA11Y_TICKET_PROVIDER,
                      then .ultra11yrc.json, then the git remote (Jira is never auto-detected)
   --grain <mode>     tickets: what one ticket is \u2014 criterion (default) | page | page-criterion | single | file
+  --effort <level>   judge (--runner cli): reasoning effort per invocation \u2014 low | medium |
+                     high | xhigh | max. Unset leaves the CLI's own default
   --transport <t>    tickets: auto|cli|rest (mcp: stdio|http). 'auto' prefers the CLI (gh/glab),
                      falling back to REST when only a token is available. Jira is REST-only
   --max-tickets <n>  tickets: refuse to file more than n tickets in one run (default 200)
@@ -69325,6 +69330,7 @@ var VALUE_FLAGS2 = /* @__PURE__ */ new Set([
   "runner",
   "grain",
   "max-budget-usd",
+  "effort",
   "timeout",
   "concurrency",
   "out",
@@ -71460,6 +71466,15 @@ async function cmdJudge(p) {
     console.error(`ultra11y judge: --grain '${grain}' is not a grain \u2014 expected 'batch' or 'criterion'.`);
     return 2;
   }
+  const effort = typeof p.flags.effort === "string" ? p.flags.effort : void 0;
+  if (effort !== void 0 && !EFFORT_LEVELS.includes(effort)) {
+    console.error(`ultra11y judge: --effort '${effort}' is not a level \u2014 expected ${EFFORT_LEVELS.map((l) => `'${l}'`).join(", ")}.`);
+    return 2;
+  }
+  if (effort !== void 0 && runner !== "cli") {
+    console.error("ultra11y judge: --effort applies to `--runner cli` only \u2014 the Messages API has no session to set an effort on.");
+    return 2;
+  }
   const key2 = typeof p.flags["api-key"] === "string" && p.flags["api-key"] ? p.flags["api-key"] : apiKeyFromEnv();
   if (!key2 && runner === "api") {
     console.error(
@@ -71533,6 +71548,7 @@ async function cmdJudge(p) {
     // requests do. `--concurrency` overrides it for a runner with room.
     concurrency: runner === "cli" ? cliConcurrency : void 0,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
+    effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,
     onCost: (usd) => {
       spent += usd;

package/skills/ultra11y/SKILL.md

@@ -4,7 +4,7 @@ description: "Use to AUDIT existing HTML/CSS/JSX against WCAG 2.2 AA accessibili
 when_to_use: "Invoke when the user asks for an accessibility AUDIT or a formal deliverable: audit a repo, site or page against WCAG 2.2 AA or a country standard (RGAA, Section 508, EN 301 549); produce a dated conformance report, a criterion grid, a PRD backlog, or tickets (GitHub/GitLab/Jira); author accessible markup from scratch; wire the repo gate (init --hook/--ci) or a rendered-DOM capture pipeline. For a review of the code UNDER CHANGE (diff, branch, PR), use the `review-a11y` skill instead."
 license: MIT
 metadata:
-  version: 5.33.1
+  version: 5.34.0
 ---
 
 # ultra11y — audit WCAG 2.2 AA and write accessible markup

package/skills/ultra11y/scripts/ultra11y.mjs

@@ -6,7 +6,7 @@ import { join as join52, relative as relative5, resolve as resolve16, sep as sep
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL3 } from "url";
 
 // src/types.ts
-var VERSION = "5.33.1";
+var VERSION = "5.34.0";
 var SCHEMA_VERSION = 2;
 var INAPPLICABLE_STATUS = "C";
 
@@ -2293,7 +2293,7 @@ var wcag_universe_default = {
   wcagVersion: "2.2",
   source: "https://www.w3.org/TR/WCAG22/",
   criteriaSource: "https://github.com/w3c/wcag",
-  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-24 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  provenance: "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-25 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   criteria: [
     {
       id: "1.1.1",
@@ -60588,6 +60588,7 @@ function applyRawVerdicts(items, verdicts) {
 var ALLOWED_TOOLS = "Read,Grep,Glob";
 var MAX_ATTEMPTS2 = 4;
 var DEFAULT_CLI_MODEL = "claude-haiku-4-5-20251001";
+var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var DEFAULT_TIMEOUT_MS2 = 10 * 6e4;
 function realSpawn(argv, input, timeoutMs) {
   return new Promise((resolve17, reject) => {
@@ -60664,6 +60665,7 @@ function cliArgv(opts, items) {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return argv;
 }
 function verdictsFromText(text) {
@@ -60726,6 +60728,7 @@ async function refuteBatchCli(items, prompt, opts, lang = "en") {
     opts.model ?? DEFAULT_CLI_MODEL
   ];
   if (opts.maxBudgetUsd !== void 0) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  if (opts.effort) argv.push("--effort", opts.effort);
   return runCli2(argv, prompt, opts, (env) => {
     const structured = env.structured_output?.verdicts;
     const raw = Array.isArray(structured) ? structured : verdictsArrayFromText(env.result ?? "");
@@ -68889,7 +68892,7 @@ Usage:
   ultra11y orchestrate --run <dir> [--phase adjudicate|verify-report] [--eco] [--list] [--lang auto|en|fr]
   ultra11y fix      <globs\u2026 | -> [--write] [--iterate] [--changed | --since <ref> | --staged] [--safe] [--include <glob>] [--exclude <glob>] [--ext <list>] [--only <ids>] [--jsx] [--json] [--lang auto|en|fr]
   ultra11y init     [--hook] [--ci] [--baseline] [--fail-on blocking|major|minor]
-  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
+  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--effort <level>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model \u2014 api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
   ultra11y pack     check <pack.json> [--guidance <g.json>] [--json]  |  pack scaffold
   ultra11y scan     <url|file\u2026> [--runtime auto|local|docker] [--cwd <dir>] [--storage-state <file>] [--no-interact] [--interact-clicks] [--no-snapshot] [--merge <audit.json>] [--out <dir>] [--json]
   ultra11y scan     --sample [--runtime \u2026] [--cwd <dir>] [--storage-state <file>] [--merge <audit.json>] [--json]   (scan the .ultra11yrc.json page sample)
@@ -69122,6 +69125,8 @@ Options:
   --provider <id>    tickets: auto|github|gitlab|jira. 'auto' reads ULTRA11Y_TICKET_PROVIDER,
                      then .ultra11yrc.json, then the git remote (Jira is never auto-detected)
   --grain <mode>     tickets: what one ticket is \u2014 criterion (default) | page | page-criterion | single | file
+  --effort <level>   judge (--runner cli): reasoning effort per invocation \u2014 low | medium |
+                     high | xhigh | max. Unset leaves the CLI's own default
   --transport <t>    tickets: auto|cli|rest (mcp: stdio|http). 'auto' prefers the CLI (gh/glab),
                      falling back to REST when only a token is available. Jira is REST-only
   --max-tickets <n>  tickets: refuse to file more than n tickets in one run (default 200)
@@ -69325,6 +69330,7 @@ var VALUE_FLAGS2 = /* @__PURE__ */ new Set([
   "runner",
   "grain",
   "max-budget-usd",
+  "effort",
   "timeout",
   "concurrency",
   "out",
@@ -71460,6 +71466,15 @@ async function cmdJudge(p) {
     console.error(`ultra11y judge: --grain '${grain}' is not a grain \u2014 expected 'batch' or 'criterion'.`);
     return 2;
   }
+  const effort = typeof p.flags.effort === "string" ? p.flags.effort : void 0;
+  if (effort !== void 0 && !EFFORT_LEVELS.includes(effort)) {
+    console.error(`ultra11y judge: --effort '${effort}' is not a level \u2014 expected ${EFFORT_LEVELS.map((l) => `'${l}'`).join(", ")}.`);
+    return 2;
+  }
+  if (effort !== void 0 && runner !== "cli") {
+    console.error("ultra11y judge: --effort applies to `--runner cli` only \u2014 the Messages API has no session to set an effort on.");
+    return 2;
+  }
   const key2 = typeof p.flags["api-key"] === "string" && p.flags["api-key"] ? p.flags["api-key"] : apiKeyFromEnv();
   if (!key2 && runner === "api") {
     console.error(
@@ -71533,6 +71548,7 @@ async function cmdJudge(p) {
     // requests do. `--concurrency` overrides it for a runner with room.
     concurrency: runner === "cli" ? cliConcurrency : void 0,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : void 0,
+    effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : void 0,
     onCost: (usd) => {
       spent += usd;

package/src/agent-cli.ts

@@ -39,6 +39,12 @@ const MAX_ATTEMPTS = 4;
  *  states a model rather than inheriting one. */
 export const DEFAULT_CLI_MODEL = "claude-haiku-4-5-20251001";
 
+/** The levels `claude --effort` accepts. Enumerated here so a caller's typo is refused with a
+ *  message instead of forwarded: this CLI treats an unrecognised value the way it treats an
+ *  unrecognised flag — silently — and a ceiling that is silently nothing is the exact failure
+ *  `--max-turns` already cost this repo once. */
+export const EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
+
 /** What `claude -p --output-format json` puts on stdout. Only the fields this reads. */
 interface CliEnvelope {
   /** Where `--json-schema` puts the validated object. Present since 2.1.x; `result` carries
@@ -168,6 +174,9 @@ export function cliArgv(opts: LlmOptions, items: AdjudicationItem[]): string[] {
   // a turn budget and be an unbounded run. The bounds that are real: `--max-budget-usd`, which
   // the CLI documents, and the wall-clock kill in `judgeBatchCli`, which is ours.
   if (opts.maxBudgetUsd !== undefined) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  // `--effort` IS documented by this CLI, unlike `--max-turns` above — so it is passed, and a
+  // caller can raise how hard the model thinks without also having to change the model.
+  if (opts.effort) argv.push("--effort", opts.effort);
   return argv;
 }
 
@@ -274,6 +283,9 @@ export async function refuteBatchCli(items: VerifyItem[], prompt: string, opts:
     opts.model ?? DEFAULT_CLI_MODEL,
   ];
   if (opts.maxBudgetUsd !== undefined) argv.push("--max-budget-usd", String(opts.maxBudgetUsd));
+  // `--effort` IS documented by this CLI, unlike `--max-turns` above — so it is passed, and a
+  // caller can raise how hard the model thinks without also having to change the model.
+  if (opts.effort) argv.push("--effort", opts.effort);
   return runCli(argv, prompt, opts, (env) => {
     const structured = (env.structured_output as { verdicts?: unknown } | undefined)?.verdicts;
     const raw = Array.isArray(structured) ? structured : verdictsArrayFromText(env.result ?? "");

package/src/cli.ts

@@ -64,7 +64,7 @@ import {
   type AdjudicationFile,
 } from "./adjudicate.js";
 import { entriesFrom, isLedger, ledgerPath, mergeLedger, readLedger, replayLedger, unreadableCaptures, type VerdictLedger, writeLedger } from "./ledger.js";
-import { DEFAULT_CLI_MODEL, judgeBatchCli, refuteBatchCli } from "./agent-cli.js";
+import { DEFAULT_CLI_MODEL, EFFORT_LEVELS, judgeBatchCli, refuteBatchCli } from "./agent-cli.js";
 import { BATCH_SIZE, apiKeyFromEnv, applyRawVerdicts, judgeAll, modelFromEnv, type LlmOptions } from "./llm.js";
 import { runScan, runScanMany, runCrawlScan, runSampleScan, mergeDynamic, mergeSnapshotAudit, cleanDynamic, dockerAvailable } from "./scan.js";
 import { runScanLocal, runScanManyLocal, runCrawlScanLocal, runSampleScanLocal, localAvailable, localTierStatus } from "./scan-local.js";
@@ -142,7 +142,7 @@ Usage:
   ultra11y orchestrate --run <dir> [--phase adjudicate|verify-report] [--eco] [--list] [--lang auto|en|fr]
   ultra11y fix      <globs… | -> [--write] [--iterate] [--changed | --since <ref> | --staged] [--safe] [--include <glob>] [--exclude <glob>] [--ext <list>] [--only <ids>] [--jsx] [--json] [--lang auto|en|fr]
   ultra11y init     [--hook] [--ci] [--baseline] [--fail-on blocking|major|minor]
-  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model — api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
+  ultra11y judge    --in <audit.json> [--standard <pack>] [--runner api|cli] [--grain batch|criterion] [--max <n>] [--model <id>] [--effort <level>] [--max-budget-usd <n>] [--timeout <s>] [--out <dir>] [--apply]   (adjudicate the manual criteria with a model — api needs ANTHROPIC_API_KEY; cli runs the Claude Code CLI and takes CLAUDE_CODE_OAUTH_TOKEN too)
   ultra11y pack     check <pack.json> [--guidance <g.json>] [--json]  |  pack scaffold
   ultra11y scan     <url|file…> [--runtime auto|local|docker] [--cwd <dir>] [--storage-state <file>] [--no-interact] [--interact-clicks] [--no-snapshot] [--merge <audit.json>] [--out <dir>] [--json]
   ultra11y scan     --sample [--runtime …] [--cwd <dir>] [--storage-state <file>] [--merge <audit.json>] [--json]   (scan the .ultra11yrc.json page sample)
@@ -375,6 +375,8 @@ Options:
   --provider <id>    tickets: auto|github|gitlab|jira. 'auto' reads ULTRA11Y_TICKET_PROVIDER,
                      then .ultra11yrc.json, then the git remote (Jira is never auto-detected)
   --grain <mode>     tickets: what one ticket is — criterion (default) | page | page-criterion | single | file
+  --effort <level>   judge (--runner cli): reasoning effort per invocation — low | medium |
+                     high | xhigh | max. Unset leaves the CLI's own default
   --transport <t>    tickets: auto|cli|rest (mcp: stdio|http). 'auto' prefers the CLI (gh/glab),
                      falling back to REST when only a token is available. Jira is REST-only
   --max-tickets <n>  tickets: refuse to file more than n tickets in one run (default 200)
@@ -582,6 +584,7 @@ const VALUE_FLAGS = new Set([
   "runner",
   "grain",
   "max-budget-usd",
+  "effort",
   "timeout",
   "concurrency",
   "out",
@@ -3561,6 +3564,21 @@ async function cmdJudge(p: ParsedArgs): Promise<number> {
     return 2;
   }
 
+  // HOW HARD THE MODEL IS ASKED TO THINK, which on this worklist is not a detail: what reaches
+  // this tier is what no engine could decide. Validated rather than forwarded, because the CLI
+  // SWALLOWS AN UNKNOWN VALUE the same way it swallows an unknown flag — `--effort hgih` would
+  // read as a setting and be nothing at all, which is the failure mode this repo already ate
+  // once with `--max-turns`. Refused here, loudly, while the message can still reach a human.
+  const effort = typeof p.flags.effort === "string" ? (p.flags.effort as string) : undefined;
+  if (effort !== undefined && !EFFORT_LEVELS.includes(effort)) {
+    console.error(`ultra11y judge: --effort '${effort}' is not a level — expected ${EFFORT_LEVELS.map((l) => `'${l}'`).join(", ")}.`);
+    return 2;
+  }
+  if (effort !== undefined && runner !== "cli") {
+    console.error("ultra11y judge: --effort applies to `--runner cli` only — the Messages API has no session to set an effort on.");
+    return 2;
+  }
+
   const key = typeof p.flags["api-key"] === "string" && p.flags["api-key"] ? (p.flags["api-key"] as string) : apiKeyFromEnv();
   if (!key && runner === "api") {
     console.error(
@@ -3684,6 +3702,7 @@ async function cmdJudge(p: ParsedArgs): Promise<number> {
     // requests do. `--concurrency` overrides it for a runner with room.
     concurrency: runner === "cli" ? cliConcurrency : undefined,
     maxBudgetUsd: Number.isFinite(maxBudgetUsd) ? maxBudgetUsd : undefined,
+    effort,
     timeoutMs: Number.isFinite(timeoutMs) ? timeoutMs : undefined,
     onCost: (usd) => {
       spent += usd;

package/src/data/wcag-universe.json

@@ -2,7 +2,7 @@
   "wcagVersion": "2.2",
   "source": "https://www.w3.org/TR/WCAG22/",
   "criteriaSource": "https://github.com/w3c/wcag",
-  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-24 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
+  "provenance": "Full WCAG 2.x SC universe (all levels incl. AAA, and the removed 4.1.1 Parsing) fetched from raw.githubusercontent.com/w3c/wcag@main on 2026-08-25 via `node scripts/build-standards.mjs --refresh-universe`. Classification: core-AA = ships in src/data/wcag.json (the shipped WCAG 2.2 AA core); out-of-core = WCAG AAA; removed = obsolete (4.1.1).",
   "criteria": [
     {
       "id": "1.1.1",

package/src/llm.ts

@@ -71,6 +71,15 @@ export interface LlmOptions {
   /** Dollar ceiling handed to the CLI backend — the bound that survives whatever a turn
    *  happens to cost, which is what a CI job actually wants to cap. */
   maxBudgetUsd?: number;
+  /** Reasoning effort handed to the CLI backend (`--effort`: low, medium, high, xhigh, max).
+   *
+   *  The criteria this tier rules on are the ones no engine can decide — alt relevance, link
+   *  purpose in context, reading order — so how hard the model is asked to think is a real
+   *  lever on the verdict, and one a caller should be able to move without also changing the
+   *  model. Unlike `--max-turns`, `--effort` IS a flag of this CLI, so it is passed rather
+   *  than refused. The Messages backend ignores it: effort is a session notion there, not a
+   *  request parameter. */
+  effort?: string;
   /** Called with each invocation's real cost, so a run can report what it spent instead of
    *  leaving the reader to find it in a provider dashboard. */
   onCost?: (usd: number) => void;

package/src/types.ts

@@ -1,6 +1,6 @@
 // Single source of truth for shared types + the embedded version. sync-version.mjs
 // rewrites VERSION at release time (kept in lockstep with package.json + SKILL.md).
-export const VERSION = "5.33.1";
+export const VERSION = "5.34.0";
 export const SCHEMA_VERSION = 2;
 
 // Lang = the UI FRAME's language — the `L` localization tables each module (report,